Skip to content

Commit f7b8d1e

Browse files
author
Sakthi Vetrivel
committed
Merge branch 'private-cluster' of https://github.com/lamek/azure-docs into aro-private-cluster
2 parents 3980eb0 + 149f26f commit f7b8d1e

File tree

1 file changed

+151
-0
lines changed

1 file changed

+151
-0
lines changed

‎articles/openshift/howto-create-private-cluster.md

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
---
2+
title: Create a private cluster with Azure Red Hat OpenShift 3.11 | Microsoft Docs
3+
description: Create a private cluster with Azure Red Hat OpenShift 3.11
4+
author: klamenzo
5+
ms.author: b-lejaku
6+
ms.service: container-service
7+
ms.topic: conceptual
8+
ms.date: 03/02/2020
9+
keywords: aro, openshift, private cluster, red hat
10+
#Customer intent: As a customer, I want to create a private cluster on ARO OpenShift.
11+
---
12+
13+
# Create a private cluster with Azure Red Hat OpenShift 3.11
14+
15+
> [!IMPORTANT]
16+
> ARO private clusters are currently only available in private preview in East US 2. Private preview acceptance is by invitation only. Please be sure to register your subscription before attempting to enable this feature.
17+
18+
Private clusters provide the following benefits:
19+
20+
* Private clusters do not expose cluster control plane components (such as the API servers) on a public IP address.
21+
* The VNet of a private cluster is configurable by customers, allowing you to set up networking to allow peering with other VNets, including ExpressRoute environments. You can also configure custom DNS on the VNet in order to integrate with internal services.
22+
23+
## Before you begin
24+
25+
> [!NOTE]
26+
> This feature requires version 2019-10-27-preview of the ARO HTTP API. It is not yet supported in the Azure CLI.
27+
28+
The fields in the following configuration snippet are new and must be included in your cluster configuration. `managementSubnetCidr` must be within the cluster VNet and is used by Azure to manage the cluster.
29+
30+
```
31+
properties:
32+
networkProfile:
33+
managementSubnetCidr: 10.0.1.0/24
34+
masterPoolProfile:
35+
apiProperties:
36+
privateApiServer: true
37+
```
38+
A private cluster can be deployed using the sample scripts provided below. Once the cluster is deployed, execute the `cluster get` command and view the `properties.FQDN` property to determine the private IP address of the OpenShift API server.
39+
40+
The cluster VNet will have been created with permissions so that you can modify it. You can then setup networking to access the VNet (ExpressRoute, VPN, VNet peering) as required for your needs.
41+
42+
If you change the DNS nameservers on the cluster VNet, then you will need to issue an update on the cluster with the `properties.RefreshCluster` property set to `true` so that the VMs can be reimaged. This will allow them to pick up the new nameservers.
43+
44+
## Sample Configuration Scripts
45+
46+
Use the sample scripts in this section to setup and deploy your private cluster.
47+
48+
### Environment
49+
50+
Fill in the environment variables below as using your own values.
51+
52+
> [!NOTE]
53+
> The locatin must be set to `eastus2` as this is currently the only supported location for private clusters.
54+
55+
```
56+
export CLUSTER_NAME=
57+
export LOCATION=eastus2
58+
export TOKEN=$(az account get-access-token --query 'accessToken' -o tsv)
59+
export SUBID=
60+
export TENANT_ID=
61+
export ADMIN_GROUP=
62+
export CLIENT_ID=
63+
export SECRET=
64+
```
65+
66+
### private-cluster.json
67+
Using the environment variables defined above, here is a sample cluster configuration with private cluster enabled.
68+
69+
```
70+
{
71+
"location": "$LOCATION",
72+
"name": "$CLUSTER_NAME",
73+
"properties": {
74+
"openShiftVersion": "v3.11",
75+
"networkProfile": {
76+
"vnetCIDR": "10.0.0.0/8",
77+
"managementSubnetCIDR" : "10.0.1.0/24"
78+
},
79+
"authProfile": {
80+
"identityProviders": [
81+
{
82+
"name": "Azure AD",
83+
"provider": {
84+
"kind": "AADIdentityProvider",
85+
"clientId": "$CLIENT_ID",
86+
"secret": "$SECRET",
87+
"tenantId": "$TENANT_ID",
88+
"customerAdminGroupID": "$ADMIN_GROUP"
89+
}
90+
}
91+
]
92+
},
93+
"masterPoolProfile": {
94+
"name": "master",
95+
"count": 3,
96+
"vmSize": "Standard_D4s_v3",
97+
"osType": "Linux",
98+
"subnetCIDR": "10.0.0.0/24",
99+
"apiProperties": {
100+
"privateApiServer": true
101+
}
102+
},
103+
"agentPoolProfiles": [
104+
{
105+
"role": "compute",
106+
"name": "compute",
107+
"count": 1,
108+
"vmSize": "Standard_D4s_v3",
109+
"osType": "Linux",
110+
"subnetCIDR": "10.0.0.0/24"
111+
},
112+
{
113+
"role": "infra",
114+
"name": "infra",
115+
"count": 3,
116+
"vmSize": "Standard_D4s_v3",
117+
"osType": "Linux",
118+
"subnetCIDR": "10.0.0.0/24"
119+
}
120+
],
121+
"routerProfiles": [
122+
{
123+
"name": "default"
124+
}
125+
]
126+
}
127+
}
128+
```
129+
130+
## Deploy a private cluster
131+
132+
After configuring your private cluster with the sample scripts above, run the following command to deploy your private cluster.
133+
134+
```
135+
az group create --name $CLUSTER_NAME --location $LOCATION
136+
137+
cat private-cluster.json | envsubst | curl -v -X PUT \
138+
-H 'Content-Type: application/json; charset=utf-8' \
139+
-H 'Authorization: Bearer '$TOKEN'' -d @- \
140+
https://management.azure.com/subscriptions/$SUBID/resourceGroups/$CLUSTER_NAME/providers/Microsoft.ContainerService/openShiftManagedClusters/$CLUSTER_NAME?api-version=2019-10-27-preview
141+
```
142+
143+
## Diagrams
144+
145+
### Private Cluster Architecture
146+
147+
![](diagrams/private-cluster-diagram.png)
148+
149+
### Data Flow
150+
151+
![](diagrams/private-cluster-data-flow.png))

0 commit comments

Comments
 (0)